- Freeradius-Users - lists.freeradius.org

EAP-Message help
by Ahmet DÜLGAR 02 Sep '08

02 Sep '08

hi, iam using fedora 9 and freeradius 2.0.5 i am new at freeradius i configured freeradius by using wiki.freeradius.com howto wpa and mysql connectin everting is ok when test with radtest or NTRadPing it is working then i create certificates by using make /etc/raddb/certs/make then configure eap.conf file for the file paths when i try to connect with phone hp ipaq514 voice messenger with windows mobile 6 standart it doesnt the log is above thanks for reply best regards Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=2, length=75 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000a016672656466 NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0x09b6f0b9f8e49b359324c6b6615b1f3c+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop expand: %{User-Name} -> fredfrlm_sql (sql): sql_set_user escaped user --> 'fredf'rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, usern! ame, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY idrlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'fredf' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'fredf' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, ! Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): User found in group dynamic expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): Released sql socket id: 4++[sql] returns ok++[expiration] returns noop++[logintime] returns nooprlm_pap: Found existing Auth-Type, not changing it.++[pap] returns noop rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2rlm_eap_mschapv2: Issuing Challenge++[eap] returns handledSending Access-Challenge of id 2 to 88.232.68.198 port 1812 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x0102001f1a0102001a10b40f694adee6b042569! 01467c86cedbe6672656466 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7151f7a949d0adc7c3820393aFinished request 0.Going to the next requestWaking up in 4.9 seconds.Cleaning up request 0 ID 2 with timestamp +70Ready to process requests.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=3, length=89 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 State = 0x151d60e7151f7a949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0xc6b21f00eff9aef963a78417171ca381+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop e! xpand: %{User-Name} -> fredfrlm_sql (sql): sql_set_user escaped user - -> 'fredf'rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY idrlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'fredf' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'fredf' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%! {Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): User found in group dynamic expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): Released sql socket id: 3++[sql] returns ok++[expiration] returns noop++[logintime] returns nooprlm_pap: Found existing Auth-Type, not changing it.++[pap] returns noop rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1++[eap! ] returns handledSending Access-Challenge of id 3 to 88.232.68.198 por t 1812 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7141e79949d0adc7c3820393aFinished request 1.Going to the next requestWaking up in 4.9 seconds.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=4, length=161 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203004e198000000044160301003f0100003b0301bcebeb91ed9bd986a195dfa0781baed40e796a4871993c1a42feee06af7ea3f2000014002f003500040005000a000900640062000300060100 State = 0x151d60e7141e79949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0xae29ddd04e13e00cacdff162e56eea29+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] ret! urns noop rlm_eap: EAP packet type response id 3 length 78 rlm_eap: Continuing tunnel setup.++[eap] returns ok rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 68rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 003f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_! accept: Need to read more data: SSLv3 read client certificate AIn SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED++[eap] returns handledSending Access-Challenge of id 4 to 88.232.68.198 port 1812 EAP-Message = 0x0104040019c0000008bb160301004a02000046030148bd4d107d305bb340e906e9227e66b88f083da3b498fac401412546ce31f3e020adff87a7dfe367a6cb0458cfbbb47509c0dec990fbaeffda8550531f4477de22002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303832393135343335315a170d3039303832393135343335315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c! 65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c8724bd3d2f8cba9064070ab59fd1da710b93549b417644dc713593bc315 EAP-Message = 0xc6ba9db08a4da00aaf0cf7d9d222022863c37f448b78f92ef83c6d41a2771077012b44d8fcc5ddbaa0b7fffe948f0740fb1e24be23c673fb880d2f404dbe1af965196f60e147a214bc99feee7d944af93394a5cd121062d624b9abcc2bb1486aaa06aff579692e5a1b7bff8a96646c2531dc205aa7611439cb21cbf1b9cbaa27e875f32a5f3a4f81127edec516f233b6872e70fa63960adf139f5cef9b9cb490c786ebc90971785f44860a4a984fd98c893710e5c52f552acb2da6f96629b7da18226632f71ff4f21e28afed4bb4eea260084732b818b85872bec32fa8fe37c355590203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100bedb2fdc9f0b7b294c9ba9d2aa41ef62bebd926e5367f307a3dcf691dd15297fed8a02f3f1cfd27286512e8f097fb94f5ce7b038cf2b7a5e9666906ae0a46c81721c70a8b0769aa1ac56573dcbcc37c897749dbe! 17c3fc9adc86fba01776ae9e8633e26dab5df3de503077e295f27d1fac9f0d04c2b724 f5ba8e0b160652cfceb90ae3327bddffc0ae9962becbcc4ae2859d708d52400b508acfd8ec3c7c944672daeb46e0ae1f5a07926a4f14b5f1815e724973fae1dd030703801a7f58f6cd1b87c8507e8d70bf104e7230d03cb49cfa11a6b1c30dca1ace6de6841e93e167e33f3f08878d EAP-Message = 0x40cfb1207782f80db36bf525 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7171979949d0adc7c3820393aFinished request 2.Going to the next requestWaking up in 4.7 seconds.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=5, length=89 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 State = 0x151d60e7171979949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0x6895d55d69b15f1217c98df49dc9f7bb+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packe! t type response id 4 length 6 rlm_eap: Continuing tunnel setup.++[eap] returns ok rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED++[eap] returns handledSending Access-Challenge of id 5 to 88.232.68.198 port 1812 EAP-Message = 0x010503fc1940afffeff3ca66f8c0d7ebff0ad54c0004ab308204a73082038fa003020102020900c2ea1bc473e970d6300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469! 66696361746520417574686f72697479301e170d3038303832393135343335315a170d 3038303932383135343335315a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d476404929c0754b9c2e6383b2ecc21a51da896284fb791574b777126060dc9f48d5ea73ebf5f3ac22b3feffbc2e711524d59a62e9ddb67c9cf877b6da5319d92222baa46f5a87e5d1e49f0eab077c EAP-Message = 0x332d9e414225e89ea4b649b314946ca4768d3a7b512904a4e306055271a72c99fb11990c268a276e7ee4f14592e0ba5a43378cf8a6634b1d683306ce3942516c0e42e65530ff68c82b274f9db29ae2f1ce849144f41f8814413796c85bfe1847b762d566c4caeb8a49632ba75891509498c39b9bb6465cbc65cc4da7f7c61ca2c6854a36042733a832f787b54f8575e0a78e99f6ae9ae345a86669f7bfbeb0e51d915a56ce535c13855ca7c0d590214d910203010001a381fb3081f8301d0603551d0e041604145ed3fe3! 86bcbd98a1b39d274a83c63fbd1d0e8543081c80603551d230481c03081bd80145ed3fe386bcbd98a1b39d274a83c63fbd1d0 EAP-Message = 0xe854a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900c2ea1bc473e970d6300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010043d24f57da27341993923c32e4d20a629033d989264f9dd2e30b0ebf7b24e536763ca5311a3b0c1f8b8e126e32ceacd38fab EAP-Message = 0x9b46ebf107121ea6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7161879949d0adc7c3820393aFinished request 3.Going to the next requestWaking up in 4.3 seconds.Cleaning up request 1 ID 3 with timestamp +100Waking up in 0.2 seconds.Cleaning up request 2 ID 4 with timestamp +100Waking up in 0.3 seconds.Cleaning up reques! t 3 ID 5 with timestamp +100Ready to process requests. _________________________________________________________________ Yeni nesil Windows Live Services'ı ücretsiz edinin. http://get.live.com

1 0

Unable to authenticate to 10.5.4 open directory
by Thomas von Eyben 02 Sep '08

02 Sep '08

Hi there, I have been googling and searching the archives for help - no luck so far. I am trying to get Mac OS X 10.5.4 Server to authenticate against the Open Directory in order to provide "http://eduroam.org" service - so far with no luck. I AM able to authenticate against my hardcoded users in the /users file so I know that part (most?) of the setup is working (firewall, proxying etc). Running radiusd in debug mode: (sudo /usr/sbin/radiusd -X -f) gives this good debug info (please help me find my problem as I am not yet an expert within the RADIUS - yet :-) Testclient is also Mac OS X 10.5.4 though a Client - not a Server :) rad_recv: Access-Request packet from host 130.225.242.107:1814, id=26, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.107:1814, id=27, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 130.225.242.107:1814, id=28, length=201 Received packet from 130.225.242.107 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 26 with timestamp 48b8514f Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 27 with timestamp 48b85151 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 28 with timestamp 48b85153 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 130.225.242.106:1814, id=19, length=201 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0203001501746573747573657240627269632e646b Message-Authenticator = 0x5216ae078ddb62a4e787498caba6c2f6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 19 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010400061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6b55b82a65c27423545059bd72c3a1a3 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=20, length=310 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0204007015800000006616030100610100005d030148b8515f5a170a84693976f3002d3d2f17b996dfb6a11461d76e12aa04c823b1000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x6b55b82a65c27423545059bd72c3a1a3 Message-Authenticator = 0x2290f9444384fa8a336e277b8f63f4a5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0205], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 20 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0105026c158000000262160301004a02000046030148b8515fe87904cb4446203056b73fd1aa5ba41024828ee331b8ec32a39a1e5b20cef766ec6a5dce450efd2bb291ec7b40b0f4030813d956b6caf6653d6165e6f8002f0016030102050b0002010001fe0001fb308201f730820160a00302010202043d6c7d37300b06092a864886f70d0101053030310d300b06035504030c0474657374310d300b060355040a0c04427269633110300e060355040b0c07627269632e646b301e170d3037313232303030313935355a170d3038313131383231303734305a3030310d300b06035504030c0474657374310d300b060355040a0c0442726963311030 EAP-Message = 0x0e060355040b0c07627269632e646b30819f300d06092a864886f70d010101050003818d0030818902818100b528df96ddfa57a15ea58d4e10a91abaf7593617eb2678914c78a75f7a46f1871b1f6ed38cd1cfa5f6f98cb40d439d8b065dab0225408e6e5089b6bff5a5f8188d9ed6e48eb7890c1a05d38babe9d5f7e8824400e8d84713c1eb3bed51958cec1f2bffd25c58ee07f0c8c86ba191bdeae66859cde52751dc3679d4363a0e75170203010001a320301e300b0603551d0f0404030202b4300f0603551d130101ff04053003010100300d06092a864886f70d010105050003818100174fa69b358ee0e1e5334a00b51cbe7544cde878d7c81e EAP-Message = 0x8f7f6e4baf89af1d373dbfe40df55287642014d4918bec674b195de4d5ebcd57496fb21acffdcc4947db69f77a837ff8337c302cb8daef2c2273b33f92d0b5565939dc09fadd01e3bac3f88eb1a14e3d18aa2f66fedac03fda91cc14e9bc346acce1dc7295f117ef3316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa7a08498b7d8fd373619e637a6b9497f Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=21, length=406 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x020500d01580000000c616030100861000008200809c6256be59d58444084217ef937e20ab4e9addb1d7a71164b4bdb4dd90f9c51cebc2c3d0f966d9ae13036119cf961595f38b28ea311c563f363836b99c0eff13b77e110076d212203447dcd9889852f9f8d2b00a161bebe33abca071a91f9020d16a4493c0f823809ad6c3f27235f881029ca6dbe15ccef1c1ee9fd8b7e01e5a14030100010116030100309904a5ef25e86c0ff9c272ad5540fc6e6c9cb1c478a821a9e403953262bd772da137dd3360670763c1b23de636783813 State = 0xa7a08498b7d8fd373619e637a6b9497f Message-Authenticator = 0xa300f3c74dfa418d42a8476478f7004f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 5 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 21 to 130.225.242.106 port 1814 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106004515800000003b14030100010116030100307324aca9a0624587c31701d7b81b24d1e2c097d5ce09f15c0453da9c701026b1becb4154c55342e02d2ce85c2b40ea23 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb62e9c7f0b887914d1f617cc70a339 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=22, length=357 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0206009f1580000000951703010090b7d3eb1b77b7775c8190cebfb411d21e6627e9821f86d356f60efbea7c6497dc66664ceb21febfbf59b80227b6cb777d2e4c6051e8af54229d35c254d796f4d6f0e1bfe716919511042be43818729094631ebcff50c771ffc2e6df73e0c709c28830d6b82db4df8110839e0c4b153b28030486f23d112d509b68e612d592eabf5f202b68c70ddfaf2da06d3e441a8eff State = 0xcfb62e9c7f0b887914d1f617cc70a339 Message-Authenticator = 0x4d0c9e4196d02fceeaf413d2586fefbf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 159 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "testuser(a)bric.dk" MS-CHAP-Challenge = 0x63a3c34cf7df7e1ce1847c548b4c01c7 MS-CHAP2-Response = 0xe1006877cd5e3a28368d5bf9531c77e811a700000000000000004016c5470ee27eb869fd7d9d0093ffa247bdb4e6a2b89fe4 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "testuser(a)bric.dk" MS-CHAP-Challenge = 0x63a3c34cf7df7e1ce1847c548b4c01c7 MS-CHAP2-Response = 0xe1006877cd5e3a28368d5bf9531c77e811a700000000000000004016c5470ee27eb869fd7d9d0093ffa247bdb4e6a2b89fe4 FreeRADIUS-Proxied-To = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 6 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 6 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 236 radius_xlat: 'testuser(a)bric.dk' modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns ok) for request 6 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser(a)bric.dk with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. rlm_mschap: getUserNodeRef(): dsGetRecordList() status = 0, recCount=0 rlm_osx_od: ds_mschap_auth: getUserNodeRef failed modcall[authenticate]: module "mschap" returns fail for request 6 modcall: leaving group MS-CHAP (returns fail) for request 6 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client localhost port 0) TTLS: Got tunneled reply RADIUS code 3 User-Name = "testuser(a)bric.dk" TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client tld-1 port 29 cli 00-14-51-7F-C3-A2) Delaying request 6 for 1 seconds Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 130.225.242.106:1814, id=23, length=357 User-Name = "testuser(a)bric.dk" Calling-Station-Id = "00-14-51-7F-C3-A2" Called-Station-Id = "00-0B-85-84-19-E0:eduroam" NAS-Port = 29 NAS-IP-Address = 172.17.1.4 NAS-Identifier = "Cisco_ea:68:a3" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "\000800" EAP-Message = 0x0206009f1580000000951703010090b7d3eb1b77b7775c8190cebfb411d21e6627e9821f86d356f60efbea7c6497dc66664ceb21febfbf59b80227b6cb777d2e4c6051e8af54229d35c254d796f4d6f0e1bfe716919511042be43818729094631ebcff50c771ffc2e6df73e0c709c28830d6b82db4df8110839e0c4b153b28030486f23d112d509b68e612d592eabf5f202b68c70ddfaf2da06d3e441a8eff State = 0xcfb62e9c7f0b887914d1f617cc70a339 Message-Authenticator = 0x2535af39d3c8b25b89693657df5323ba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: Looking up realm "bric.dk" for User-Name = "testuser(a)bric.dk" rlm_realm: Found realm "bric.dk" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm bric.dk rlm_realm: Adding Realm = "bric.dk" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 6 length 159 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 130.225.242.106 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser(a)bric.dk/<no User-Password attribute>] (from client tld-1 port 29 cli 00-14-51-7F-C3-A2) Delaying request 7 for 1 seconds Finished request 7 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 22 to 130.225.242.106 port 1814 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 19 with timestamp 48b8515f Cleaning up request 4 ID 20 with timestamp 48b8515f Cleaning up request 5 ID 21 with timestamp 48b8515f Sending Access-Reject of id 23 to 130.225.242.106 port 1814 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 22 with timestamp 48b85161 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 7 ID 23 with timestamp 48b85163 Nothing to do. Sleeping until we see a request. Any suggestion are more than welcome(!) TvE

3 8

(no subject)
by Robert Svensson 02 Sep '08

02 Sep '08

Hi, Does the PAM module support access challenge sent from the radius server? //robert

2 1

CISCO VPN + FREERADIUS + CERTIFICATES
by Gabriel Starczewski 02 Sep '08

02 Sep '08

Hi, I successfully set up radius-based authentication with mysql database and local database of a cisco router. Nevertheless It would the most desirable for me to be able to take advantage of certificates to accomplish user authentication. I tried with eap but can not get it work. I looked for the howto on the Internet but nowhere find a solution? Is it possible just to use certs or do they have to be incorporated in some authentication mechanism, if they do what is the best ( easiest) one to set up with cisco router 2800? - any help appreciated freeradius 1.1.3 cisco router 2800 Regards, Gabriel -- Z poważaniem, Gabriel Starczewski NetShock.pl - Rozwiązania internetowe ul. Gabrieli Zapolskiej 1/405 50-032 Wrocław http://NetShock.pl - tel. (071) 710 47 66

2 3

Information required regarding the freeradius.
by Praveen Kumar 02 Sep '08

02 Sep '08

Hi, I am a newbie for FreeRadius. I need some information on freeradius regarding my requirement for authentication and session control. I want to setup the system like.. 1 One centralized server running on a Linux machine for authentication. 2 Client Linux machine in the network which should connect to the server whenever any user log in into the machine. 3 Once authenticated, the user should be allowed the single-sign on. 4 The session for that user should be restricted to one in simultaneous log in. i.e The user which is already log in should not be allowed to login into other machine in the network. 5 The machine should not allow any user to log in by using the local log in setting (/etc/passwd). i.e The machine should be connected the network or Internet for log in. I found that freeradius has the feature of authentication and session control, but not sure that the above setup can be supported and how to configure freeradius for this. Thanks in advance for the reply. Waiting for the reply. Regards Manoj

1 0

Radius --> Openldap auth: Failed to validate the user
by Laurence Mayer 01 Sep '08

01 Sep '08

4 14

Freeradius + Ldap + attributes
by Ivan . 01 Sep '08

01 Sep '08

Hi I have Freeradius configured with a backend of OpenLdap for user management. I would like to be able to pass attributes for Nortel and Juniper gear, which when statically defining users in user file is done via: user Auth-type:=Local, User-Password := "test" Juniper-Local-User-Name ="DEV", Service-Type = Administrative-User Is there a way to pass these attributes when using Ldap for user management? thanks Ivan

2 3

radclient problem
by Umar 01 Sep '08

01 Sep '08

Dear User! I have Freeradius running on FreeBSD. How i can kill or get a status of connected user?. I am trying radclient but its not working for me. echo "User-Name = umar" | radclient -x 127.0.0.1:1812 status <secret> the above command didn't work for me. Please help in this regards. Umar Draz -- View this message in context: http://www.nabble.com/radclient-problem-tp19239639p19239639.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Simultaneous-Use ..
by Alexandre J. Correa - Onda Internet 31 Aug '08

31 Aug '08

Hello, how i can setup freeradius to disconnect previous session of user that has Simultaneous-Use = 1 ?! thanks -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

2 1

Re: Fwd: MSCHAP module returns OK, authentication fails.. (SOLVED)
by James Yale 30 Aug '08

30 Aug '08

2008/8/29 James Yale <jim(a)thebiggame.org>: > 2008/8/28 <A.L.M.Buxey(a)lboro.ac.uk>: >> hi, >> >> whats wrong with that debug? looked fine here - that should >> end with a happy connection. ntlm_auth got the correct >> response. >> >> alan > > The problem is that when that log ends the WPA supplicant gets: > > -- EAP-MSCHAPV2: Invalid authenticator response in success request > > And the authentication fails. The full logs of the failure are at: > > http://jim.geezas.com/stuff/radius-debugging/eapol-ntlmuser-failure.log > for the supplicant and: > > http://jim.geezas.com/stuff/radius-debugging/radius-ntlmuser-failure.log > for radiusd. > > I'm going to try afew different distributions/versions of FreeRadius > and Samba, perhaps compile from source - presumably this configuration > is fairly common and working elsewhere, so it should work with some > combination (if I find one I'll post it up). > > Thanks, > > James > To update this, Alan DeKok was right about the issue being with Samba, but rather than using an newer version of Samba an older version was required. I compiled Samba 3.0.32 from source and EAP/MSCHAP authentication now works perfectly on FC9 with the packaged version of FreeRadius 2.0.5. Thanks to both Alans for the help :) James

1 0